Warning Signs Are a Change, Not a Personality
The useful signal is almost never a trait. It's a change. Someone steady becomes volatile. Someone social goes silent and withdrawn. Someone who followed the rules starts testing them. The behavior matters because it's different from that person's own baseline, so the people most likely to catch it early are the ones who see them every day.
That's also why a generic list of "warning signs" can mislead. Plenty of people are quiet, or frustrated, or going through something hard, and will never harm anyone. What raises concern is a pattern that's escalating, focused on a specific person, or paired with talk of harm.
Researchers who study targeted violence, including the FBI's Behavioral Analysis Unit, have found that people who carry out planned attacks usually show warning behaviors first. Prevention depends on someone noticing those behaviors and saying something while there's still time.
The Behaviors Worth Paying Attention To
No single one of these proves anything. A cluster, or one that keeps escalating, is worth raising:
- Direct or veiled threats, including ones delivered as a joke or a "what if," aimed at a person, a group, or the company.
- A grievance that hardens into fixation, where someone can't let go of a perceived wrong and keeps circling back to it.
- Escalating anger or intimidation toward coworkers, customers, or supervisors, especially when it's getting worse over weeks.
- Unusual interest in or references to weapons that are out of place for the person and the setting.
- A sharp decline paired with hopelessness, talk of having "nothing to lose," or comments about self-harm.
- Boundary testing, like showing up off-shift, ignoring warnings, or trying to reach areas or people they shouldn't.
Leakage
- What it is
- leakage is when a person reveals, on purpose or by accident, that they're considering harm, often to a third party rather than the eventual target.
- What it does
- it shows up as a comment, a message, a post, or a confession to a coworker, and it's one of the most reliable early signals of planned violence.
- Why it matters
- leakage usually reaches a peer before it reaches management, so the people who most need to know what to report are frontline employees, not only supervisors.
OSHA Groups Workplace Violence Into Four Types
Knowing the category helps a manager judge who's at risk and what to watch for. OSHA and NIOSH sort workplace violence into four types: criminal intent by a stranger, violence from a customer or client, worker-on-worker, and violence from a personal relationship that follows someone to work.
Most attention goes to the stranger with criminal intent, but the customer, the coworker, and the personal-relationship cases are the ones a manager is most likely to watch build in slow motion.
Notice and Report, Don't Diagnose
The goal isn't to decide whether someone is dangerous. It's to get a concern in front of people trained to assess it. A manager who tries to play psychologist, or who judges risk by someone's background, religion, or diagnosis, does two kinds of harm at once. They miss real behavioral signals, and they punish people who were never a threat.
Keep it behavior-based, and route it. Write down what was actually said or done, when it happened, and who saw it. Then send it to whoever owns threat assessment at your company, or to security, so a trained group can weigh it together.
Missing It Versus Catching It Early
The same signal lands very differently depending on what a manager does with it.
| The signal | Explained away | Taken seriously |
|---|---|---|
| A "joking" threat | Laughed off as venting | Written down and reported, with the tone noted |
| A hardening grievance | "That's just how they are" | Flagged before it fixates further |
| Interest in weapons | Waved off as a hobby comment | Weighed against the person's recent behavior |
| A frightened coworker's report | "Don't overreact" | Thanked, recorded, and escalated |
| Someone in visible decline | Left alone to avoid awkwardness | Offered help and connected to resources |
Early on I'd talk myself out of what I was seeing. Someone's standing where they don't belong, and I'd reach for the easy story. He's probably just waiting on a friend. Most of the time the easy story is true, and that's exactly the trap.
Your instinct picked up on something for a reason. You don't have to know the reason yet. You just don't get to ignore it. Look a little closer, ask one more question, and let a real process decide if it's nothing. Being wrong and a little embarrassed costs you nothing. Being right and quiet can cost everything.
Before You Decide a Concern Is Nothing
Run through these before you write off something that felt off:
- Is this a real change from the person's normal behavior?
- Is the behavior escalating, or aimed at a specific person?
- Has anyone heard a threat, even a joking one?
- Did a coworker come to you because they were scared?
- Have you written down what was actually said or done?
- Do you know who at your company you'd report this to today?
If you can't answer the last one, that gap is the first thing to close, and closing it is the company's job, not yours alone.
How We Handle It at ARDENT
We treat workplace violence as prevention first, long before anyone is in danger. When an employer brings us a concern, our Agents help them think it through calmly and match the response to the real risk, not to the fear in the room.
Often that means a steady presence while a situation is assessed, coordination with the employer's HR and legal people so nobody's working in the dark, and a plan the staff actually understands. We'd rather help you settle a problem early than show up after it's grown.
What we won't do is tell you from a distance that someone is or isn't dangerous. That belongs to a trained assessment process. Our part is helping you build the response around it, and being ready if the risk turns out to be real.
Key Takeaways
- Warning signs are behavior changes from a person's own baseline, not a personality type or a background.
- Threats, hardening grievances, escalating intimidation, weapon references, and visible decline are worth raising, especially in a cluster.
- Leakage, a hint of intent shared with a third party, usually reaches a coworker first, so frontline staff need to know what to report.
- A manager's job is to notice, document, and report to a process, not to diagnose or profile.
- Explaining a warning sign away is how prevention quietly fails.
Frequently Asked Questions
Isn't Watching for Warning Signs Just Profiling?
No, when it's done right. Profiling guesses risk from who a person is, like their background or beliefs. Threat assessment weighs what a person actually says and does. One is unfair and unreliable; the other is accepted practice.
What If I Report a Concern and I'm Wrong?
That's a normal, acceptable outcome. A good process expects far more false alarms than real threats, and it's built to check quietly without harming the person. Raising a concern that turns out to be nothing is the system working, not failing.
Should I Confront the Employee Myself?
Usually not. Confrontation can escalate a situation you don't yet understand. Document what you saw, report it to your threat assessment or security contact, and let a trained group decide the next step.
Who Should Employees Report Warning Signs To?
Whoever owns the process, named in advance. Common channels are HR, a threat assessment team, or security. The channel only works when people know it exists and trust that raising a concern won't come back on them.